linux-kernel - Re: [PATCH] HID: lenovo: Detect quirk-free fw on cptkbd and stop applying workaround

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <20231209165648.4rfe4gxubaajrl2z@jekhomev>
Date:   Sat, 9 Dec 2023 18:56:48 +0200
From:   Yauhen Kharuzhy <jekhor@...il.com>
To:     Mikhail Khvainitski <me@...oinitsky.org>
Cc:     Jiri Kosina <jikos@...nel.org>,
        Benjamin Tissoires <benjamin.tissoires@...hat.com>,
        linux-input@...r.kernel.org, linux-kernel@...r.kernel.org,
        ValdikSS <iam@...dikss.org.ru>
Subject: Re: [PATCH] HID: lenovo: Detect quirk-free fw on cptkbd and stop
 applying workaround

On Sat, Dec 09, 2023 at 02:50:16PM +0200, Yauhen Kharuzhy wrote:
> On Sun, Sep 24, 2023 at 01:58:30AM +0300, Mikhail Khvainitski wrote:
> > Built-in firmware of cptkbd handles scrolling by itself (when middle
> > button is pressed) but with issues: it does not support horizontal and
> > hi-res scrolling and upon middle button release it sends middle button
> > click even if there was a scrolling event. Commit 3cb5ff0220e3 ("HID:
> > lenovo: Hide middle-button press until release") workarounds last
> > issue but it's impossible to workaround scrolling-related issues
> > without firmware modification.
> > 
> > Likely, Dennis Schneider has reverse engineered the firmware and
> > provided an instruction on how to patch it [1]. However,
> > aforementioned workaround prevents userspace (libinput) from knowing
> > exact moment when middle button has been pressed down and performing
> > "On-Button scrolling". This commit detects correctly-behaving patched
> > firmware if cursor movement events has been received during middle
> > button being pressed and stops applying workaround for this device.
> > 
> > Link: https://hohlerde.org/rauch/en/elektronik/projekte/tpkbd-fix/ [1]
> 
> This patch breaks a scrolling at my ThinkPad TrackPoint Keyboard II: it
> starts to report middle-button push/release events with scrolling events
> between. A support for this keyboard was added in
> 24401f291dcc4f2c18b9e2f65763cbaadc7a1528 "HID: lenovo: Add support for
> ThinkPad TrackPoint Keyboard II" commit.

I figured this out.

This keyboard can emit REL_Y/REL_X events between of middle-button
events (if user was moving a cursor and press middle button without of
stopping this), so this algorithm does a false-positive detection and switches
the workaround off like for patched firmware:

Event: time 1702140625.854777, type 2 (EV_REL), code 1 (REL_Y), value 2
Event: time 1702140625.854777, -------------- SYN_REPORT ------------
Event: time 1702140625.870769, type 1 (EV_KEY), code 274 (BTN_MIDDLE), value 1
Event: time 1702140625.870769, -------------- SYN_REPORT ------------
Event: time 1702140625.870771, type 2 (EV_REL), code 1 (REL_Y), value 2
Event: time 1702140625.870771, -------------- SYN_REPORT ------------
Event: time 1702140625.970780, type 2 (EV_REL), code 8 (REL_WHEEL), value -1
Event: time 1702140625.970780, -------------- SYN_REPORT ------------
Event: time 1702140626.058800, type 2 (EV_REL), code 8 (REL_WHEEL), value -1
Event: time 1702140626.058800, -------------- SYN_REPORT ------------
Event: time 1702140630.462974, type 4 (EV_MSC), code 4 (MSC_SCAN), value ffa000fb
Event: time 1702140630.462974, type 1 (EV_KEY), code 274 (BTN_MIDDLE), value 0
Event: time 1702140630.462974, -------------- SYN_REPORT ------------


> 
> There is an evtest output below:
> 
> Without of commit:
> 
> Middle-button click:
> Event: time 1702122290.593300, type 1 (EV_KEY), code 274 (BTN_MIDDLE), value 1
> Event: time 1702122290.593300, -------------- SYN_REPORT ------------
> Event: time 1702122290.593312, type 1 (EV_KEY), code 274 (BTN_MIDDLE), value 0
> Event: time 1702122290.593312, -------------- SYN_REPORT ------------
> 
> Vertical scrolling:
> Event: time 1702122300.441627, type 2 (EV_REL), code 8 (REL_WHEEL), value -1
> Event: time 1702122300.441627, -------------- SYN_REPORT ------------
> Event: time 1702122300.565663, type 2 (EV_REL), code 8 (REL_WHEEL), value -1
> Event: time 1702122300.565663, -------------- SYN_REPORT ------------
> 
> Horizontal scrolling:
> Event: time 1702122307.845969, type 2 (EV_REL), code 6 (REL_HWHEEL), value -1
> Event: time 1702122307.845969, -------------- SYN_REPORT ------------
> Event: time 1702122307.981954, type 2 (EV_REL), code 6 (REL_HWHEEL), value -1
> Event: time 1702122307.981954, -------------- SYN_REPORT ------------
> 
> 
> 
> After commit:
> 
> Middle-button click:
> Event: time 1702125091.290045, type 4 (EV_MSC), code 4 (MSC_SCAN), value ffa000fb
> Event: time 1702125091.290045, type 1 (EV_KEY), code 274 (BTN_MIDDLE), value 1
> Event: time 1702125091.290045, -------------- SYN_REPORT ------------
> Event: time 1702125092.626118, type 4 (EV_MSC), code 4 (MSC_SCAN), value ffa000fb
> Event: time 1702125092.626118, type 1 (EV_KEY), code 274 (BTN_MIDDLE), value 0
> Event: time 1702125092.626118, -------------- SYN_REPORT ------------
> 
> 
> Vscroll:
> Event: time 1702125286.653639, type 4 (EV_MSC), code 4 (MSC_SCAN), value ffa000fb
> Event: time 1702125286.653639, type 1 (EV_KEY), code 274 (BTN_MIDDLE), value 1
> Event: time 1702125286.653639, -------------- SYN_REPORT ------------
> Event: time 1702125287.929689, type 2 (EV_REL), code 8 (REL_WHEEL), value -1
> Event: time 1702125287.929689, -------------- SYN_REPORT ------------
> Event: time 1702125288.037688, type 2 (EV_REL), code 8 (REL_WHEEL), value -1
> Event: time 1702125288.037688, -------------- SYN_REPORT ------------
> Event: time 1702125290.481787, type 4 (EV_MSC), code 4 (MSC_SCAN), value ffa000fb
> Event: time 1702125290.481787, type 1 (EV_KEY), code 274 (BTN_MIDDLE), value 0
> Event: time 1702125290.481787, -------------- SYN_REPORT ------------
> 
> Hscroll:
> Event: time 1702125293.841920, type 4 (EV_MSC), code 4 (MSC_SCAN), value ffa000fb
> Event: time 1702125293.841920, type 1 (EV_KEY), code 274 (BTN_MIDDLE), value 1
> Event: time 1702125293.841920, -------------- SYN_REPORT ------------
> Event: time 1702125294.761952, type 2 (EV_REL), code 6 (REL_HWHEEL), value -1
> Event: time 1702125294.761952, -------------- SYN_REPORT ------------
> Event: time 1702125294.893967, type 2 (EV_REL), code 6 (REL_HWHEEL), value -1
> Event: time 1702125294.893967, -------------- SYN_REPORT ------------
> Event: time 1702125296.134006, type 4 (EV_MSC), code 4 (MSC_SCAN), value ffa000fb
> Event: time 1702125296.134006, type 1 (EV_KEY), code 274 (BTN_MIDDLE), value 0
> Event: time 1702125296.134006, -------------- SYN_REPORT ------------

-- 
Yauhen Kharuzhy